qakbot | 53a364103209fe91a9ae7ec56bc31906eb1c2e68902d6317bebdf8f183e0ac25 | Triage

Sharing

General

Target

861d09740e77deb97a5711179346a36f_JaffaCakes118
Size

378KB
Sample

240810-p2c8kszdqp
MD5

861d09740e77deb97a5711179346a36f
SHA1

3edb804ad464b649fe21e5da1f44ba7d9f2ecbb5
SHA256

53a364103209fe91a9ae7ec56bc31906eb1c2e68902d6317bebdf8f183e0ac25
SHA512

8f55ca87bbcecc77ad02f1610fdd2c36feeed2f2dfd1a25c2dee1db03d3a0fe92052c8255e18fc9fd52a9eff2363ec8510a369b87864b36ec439087366e67e13
SSDEEP

3072:Do6vBnby4Yx0XjFFzPQ0MslzERfQB24hLxBVi/b/9+PdpiWC35ol/uwfTuT2b2MT:vs6Xpq0H3Jhds/9+qC/zfTPLt

Score

10^/10

qakbot obama104 1632729661 banker discovery evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

obama104

Campaign

1632729661

C2

95.77.223.148:443

47.22.148.6:443

89.101.97.139:443

27.223.92.142:995

120.151.47.189:443

136.232.34.70:443

120.150.218.241:995

185.250.148.74:443

181.118.183.94:443

140.82.49.12:443

67.165.206.193:993

103.148.120.144:443

71.74.12.34:443

76.25.142.196:443

73.151.236.31:443

173.21.10.71:2222

75.188.35.168:443

2.178.88.145:61202

71.80.168.245:443

45.46.53.140:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

- Target
  
  861d09740e77deb97a5711179346a36f_JaffaCakes118
- Size
  
  378KB
- MD5
  
  861d09740e77deb97a5711179346a36f
- SHA1
  
  3edb804ad464b649fe21e5da1f44ba7d9f2ecbb5
- SHA256
  
  53a364103209fe91a9ae7ec56bc31906eb1c2e68902d6317bebdf8f183e0ac25
- SHA512
  
  8f55ca87bbcecc77ad02f1610fdd2c36feeed2f2dfd1a25c2dee1db03d3a0fe92052c8255e18fc9fd52a9eff2363ec8510a369b87864b36ec439087366e67e13
- SSDEEP
  
  3072:Do6vBnby4Yx0XjFFzPQ0MslzERfQB24hLxBVi/b/9+PdpiWC35ol/uwfTuT2b2MT:vs6Xpq0H3Jhds/9+qC/zfTPLt
Score

10^/10

qakbot obama104 1632729661 banker discovery evasion stealer trojan
- Qakbot/Qbot
  Qbot or Qakbot is a sophisticated worm with banking capabilities.
  trojan banker stealer qakbot
- Windows security bypass
  evasion trojan
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

qakbotobama1041632729661bankerdiscoveryevasionstealertrojan

behavioral2

qakbotobama1041632729661bankerdiscoveryevasionstealertrojan